Privacy Policy

This policy explains what Comity collects when you use our website, your account, the comity CLI and the agent hooks it installs, why we collect it, who we share it with, how long we keep it, and how to have it deleted.

Comity is operated by Tyler Davis, an individual based in Fort Lauderdale, Florida, United States ("Comity", "we", "us"). Comity is in beta. Questions or requests: hello@comity.so.

Summary

• The CLI never sends your source code or diffs. It analyzes changes locally and sends metadata about them (file paths, symbol names, signature hashes, change counts), plus short text your agents produce or receive, such as prompt excerpts and plans. If your org connects the GitHub App, Comity can read changed files from GitHub to analyze them, without storing their contents.
• Plans, prompt-based summaries, messages, status notes and override reasons are encrypted with a key unique to your org. Some fields are not encrypted; we list them below.
• We use cookies only to keep you signed in and to secure GitHub sign-in. The website has no analytics, advertising or tracking cookies.
• We don't sell personal data, and we don't use your data to train AI models.
• Our servers and database are in the United States.
• Email hello@comity.so to access, correct or delete your data.

Who this policy covers

This policy covers visitors to comity.so and users of the hosted Comity service at api.comity.so. When your employer or team sets up a Comity org, the org's owner decides what work is shared in it, and we process the org's data on its behalf and under its instructions. If you have questions about how your team uses Comity, you can also ask your org's owner.

Self-hosted deployments are different: if your organization runs Comity on its own infrastructure, the data stays there and is governed by your organization's own policies, not this one. See Self-hosted deployments.

Account and org information

When you sign up

• Email address (required) and name (optional).
• Password, if you sign up with email. We store only a salted scrypt hash of it, never the password itself.
• GitHub account ID and username, if you sign in with GitHub. We ask GitHub for read-only access to your profile and email addresses (read:user and user:email), use your verified primary email as your account email, and take your GitHub display name if you haven't given us a name. We use GitHub's access token once during sign-in and do not store it.
• When your email was verified and when you last logged in.

Orgs and teammates

• The name and URL slug of orgs you create, your role in each org, and invitations you send or receive (including the invited email address).
• Members of an org can see each other's names, email addresses and roles, and the work shared in the org, including which of each member's agent sessions are active and in which repository and branch.

Sign-in and security records

• Web sessions: for each signed-in browser we store a hash of the session cookie, your browser's user-agent string, and when the session was created, last used, expires or was revoked.
• CLI and API tokens: we store only a hash of each token, a short display prefix, its name and when it was last used. When you run comity login, the CLI sends your computer's hostname so the token can be named after the machine (for example, cli · my-laptop).
• Account events: sign-ups, logins, failed logins, logouts, email verifications, password resets, GitHub linking and CLI approvals are recorded with the IP address they came from, so that we and you can investigate suspicious activity.
• Rate limiting: we count requests per IP address and per account in memory to slow down abuse. These counters are not written to the database.

Data from the CLI and agent hooks

When you run comity init in a repository, Comity installs hooks and an MCP server into your coding agents' configuration. The hooks call our API when an agent session starts, when you send a prompt, before the agent edits files or runs a shell command, after it edits files, when it writes a plan, and when it stops. The table lists what those calls contain.

From this data Comity derives the team briefings, conflicts, policy decisions and activity feed you see in your agents and in the dashboard. Conflicts are stored with their subject (a path or symbol), evidence, explanation and suggestion.

The CLI talks only to the Comity server it is logged in to (by default, https://api.comity.so). It contains no telemetry or analytics. Hook failures are written to a log file on your own machine.

Data modes

Each org has a data mode. The default is full.

• full: everything in the table above, including the text of changed function and type signatures, which makes contract-break explanations more specific.
• metadata_only: the CLI does not send signature text (only signature hashes), and the server discards any signature text it receives unless the org has explicitly opted back in. With the GitHub App, Comity does not read file contents (see below).

metadata_only applies to code-derived signature text. File paths, symbol names, prompt excerpts, plans, status notes and messages are sent in both modes. During the beta, the data mode is set by us on request: email hello@comity.so to switch an org.

GitHub App

An org can optionally connect a GitHub App, which Comity creates in your own GitHub account or organization from a manifest, to detect conflicts with pushed branches and pull requests. It asks for read access to repository contents and metadata, and write access to checks and pull requests; it receives push, pull_request, create and delete events.

• For each pushed branch or pull request we store the branch name, commit hashes, pull request number, the GitHub username of the pusher, and the changed file paths with their line counts. The pusher's email address is used only to match them to an org member.
• In full mode, Comity downloads the changed files from GitHub, analyzes them in memory, and stores only the resulting symbols and signatures, never the file contents. In metadata_only mode it does not download file contents.
• Comity writes check runs on commits to report conflicts. It does not post pull request comments.
• Raw webhook deliveries are stored encrypted and deleted after 7 days. The app's private key and secrets are stored encrypted.

Slack and webhooks

These are sent only if someone in your org configures them, to the destination they choose:

• Slack: conflict and block notifications include the repository name, the conflict's subject (a file path or symbol), explanation and suggestion, and the email addresses of the members involved.
• Webhooks: signed event notifications containing IDs, types and counts, sent only to HTTPS endpoints. We keep a record of each delivery.

Slack webhook URLs and webhook endpoint URLs and secrets are stored encrypted. Once data reaches Slack or your endpoint, the recipient's terms and policies apply.

Billing information

Paid plans are billed through Stripe. You enter payment details on Stripe-hosted pages, so card numbers and billing details never reach our servers. We send Stripe your org's name and identifier, the purchasing owner's email address, and the monthly number of active developers. We store the Stripe customer and subscription IDs, the plan, the subscription status and dates, and the active-developer count we reported. Stripe processes payment data under its own privacy policy.

To count active developers, we record which members made an agent hook call, MCP call or API change in each calendar month.

Website, cookies and emails

• Cookies: after you log in, the API sets comity_session, a cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax, valid for 30 days of inactivity). During GitHub sign-in it briefly sets comity_oauth (10 minutes) to protect against forged sign-ins. There are no analytics, advertising or third-party tracking cookies, and no tracking scripts on comity.so.
• Local storage: the website remembers in your browser which org you last opened, the dashboard date range you chose, and where to send you after you sign in.
• Server logs: the website is served by Cloudflare, which processes your IP address to deliver pages and protect against attacks, and keeps request logs for a limited time. Our API server's web server logs requests, including IP address and user agent, in logs that are rotated by size. The API's own application logs contain the request method, path and status, but not your IP address or request contents.
• Emails: we send transactional emails only: email verification, password resets, a notice if someone tries to sign up with your address, and invitations. They are delivered by Resend. They load the Comity header image from comity.so and contain no tracking pixels. We do not send marketing emails.

How we use information

• To provide the service you or your org asked for: accounts and sign-in, team briefings, conflict detection, policies, notifications, and the dashboard. (Legal basis under GDPR, where it applies: performance of our contract with you or your org.)
• To keep it secure: authentication, rate limiting, account security records, and investigating abuse. (Legitimate interests.)
• To bill for paid plans and enforce plan limits. (Contract.)
• To support you and to send service and account notices, including changes to our terms. (Contract and legitimate interests.)
• To comply with law and respond to valid legal requests. (Legal obligation.)

We don't sell or rent personal data, don't share it for cross-context behavioral advertising, don't use your data to train AI models, and don't make automated decisions that have legal or similarly significant effects on you.

How we protect it

• Plans, prompt-based intent summaries, messages and thread subjects, questions and answers, status notes, override reasons, integration and webhook settings, and GitHub App secrets are encrypted with AES-256-GCM under a data key unique to your org. Org keys are themselves encrypted under a master key that is not stored in the database.
• Not encrypted at the application level: account details (email, name), intent titles (including titles taken from prompts), repository names and remotes, branch names, file paths, symbol names, signature text and hashes, conflict details, the event log, and IP addresses in account events. These are protected by the access controls below and by HTTPS in transit.
• Requests from your agents and dashboard that read or write org data run under PostgreSQL row-level security scoped to your org. Passwords, session cookies, tokens and email links are stored only as hashes. All traffic to the website and API uses HTTPS.

More detail is on our Security page. No system is perfectly secure; if we learn of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires.

Who we share it with

• Your org: work you and your agents share in an org is visible to that org's members and their agents, and its owner can manage your membership.
• Service providers who process data for us under contract: Amazon Web Services (hosting, database and backups), Cloudflare (website and DNS), Resend (email), GitHub (sign-in, and the GitHub App if your org connects it) and Stripe (payments). The full list, with locations, is on the Security page.
• Destinations you configure: Slack and webhook endpoints, as described above.
• Legal and safety: when required by law or valid legal process, or to protect the rights, safety or security of our users, the public or Comity.
• Business transfers: if Comity is moved into a company formed to operate it, or is acquired, your data may transfer to that company, which must honor this policy.

Where data is stored

The Comity API, database and backups run on Amazon Web Services (Lightsail) in the United States. The website is served from Cloudflare's global network. If you use Comity from outside the United States, your data is transferred to and processed in the United States, where data-protection laws may differ from yours. Where required, we rely on appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep account and org data, including the activity history and event log, for as long as the account or org exists, because the history and audit trail are part of the service. Some data is kept for less time:

• Hook responses: about 10 minutes, to deduplicate repeated hook calls.
• GitHub sign-in state: deleted when it expires (10 minutes). CLI login codes: deleted a day after they expire.
• Raw GitHub webhook deliveries: 7 days. Stripe webhook records: 30 days.
• Status notes: the latest 20 per agent session.
• Email verification and password reset links stop working after 24 hours and 1 hour.
• Database backups: taken daily and kept for 14 days.

When an account or org is deleted, we delete its data from the live database within 30 days, and it disappears from backups as they expire, 14 days later at most. We may keep limited records longer where the law requires (for example, billing records for tax purposes).

Deleting your data

During the beta, deletion is handled by request. Email hello@comity.so from the address on your account and tell us what you want deleted:

• Your account: we delete your profile, sessions, tokens and security records, and remove you from your orgs. Work you shared in an org belongs to that org; we delete or de-identify it at the org's request.
• An org (owner request): we delete the org and everything stored for it, including intents, plans, messages, conflicts, snapshots, integrations, tokens and its event log.

An org's owner and admins can remove members at any time in the dashboard, which also revokes those members' tokens. We may need to verify your identity before acting on a request.

Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to:

• know what personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• object to or restrict certain processing, and withdraw consent where we rely on it;
• not be discriminated against for exercising these rights.

We extend these rights to all users regardless of where they live. To use them, email hello@comity.so; we respond within 30 days. You may use an authorized agent, and you may complain to your local data-protection authority. If your org's owner controls the data in question, we may pass your request to them.

Children

Comity is a tool for software teams and is not meant for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, email us and we will delete it.

Self-hosted deployments

Comity can be run on your own infrastructure with Docker Compose. In a self-hosted deployment the data is stored and processed on your servers, not ours, and your organization decides how it is collected, kept and protected. This policy covers only the website and any data a self-hosted installation sends to us, such as when its administrators email us.

Changes to this policy

We will update this policy when our practices change. The "Last updated" date at the top shows the latest version. If a change materially affects how we handle your data, we will tell you by email or in the dashboard before it takes effect.

Contact

Comity, operated by Tyler Davis, Fort Lauderdale, Florida, United States. Email: hello@comity.so.